Got an interesting question for the team, apologies for the wall of text:
I have a user for [Client Name Redacted] that gets an error accessing a specific file ([Redacted Program Name.exe]) installed through a UNC path onto his server. Specifically it says he does not have permission to the file. Interestingly though, he does have enumerated NTFS and share permissions to the file, folder, and parent folder structure. Other files in the same folder are accessible by him and have the same permissions (Share and NTFS, inherited through security group on local AD). It’s not an issue of permission inheritance from the security group not populating because Kerberos hadn’t updated the user’s security group context yet, because he had restarted his PC and relogged in (Verified through Device Uptime) since the issue began and was also able to access other files installed at the same time, including the uninstall.exe file. I also brute forced the security context by enumerating the share through the user’s individual account as a temporary troubleshooting step. This still did not work. I also tried to run as a Domain Administrator both from the UNC path AND locally on the server and both gave the generic “You do not have permission to run this. Please contact an administrator.”
The user was also the one who installed the program into the server UNC path (See ticket for exact Path) and was able to uninstall the program ([Redacted Program Name.exe]) as well, which would also require the requisite permissions to access the files contained within. Since we resolved the issue by uninstalling the new version ([Redacted Program Name.exe]) and reverting to the old version ([Redacted Program Name.exe]), the old application file no longer exists, but I did right click the properties of the file and have kept open a comparison on the [Redacted Server Name] file server. Google-fu has been no help because the results are primarily basic “How to file share on Windows” answers sprinkled in with some other weirdness not applicable to this situation.
But does anyone have a clue as to what could be causing this? I would like to get the user onto the more updated version of [Redacted Program Name.exe], as well as solve the puzzle that has fallen into my lap
[Originally sent through internal Teams message. Information redacted where necessary for confidentiality of client]